A vulnerability has been discovered in file, which could lead to a denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.42 | >= 5.42 |
The file utility attempts to identify a file’s format by scanning binary data for patterns.
Multiple vulnerabilities have been discovered in file. Please review the CVE identifiers referenced below for details.
File has an stack-based buffer over-read in file_copystr in funcs.c.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.42"
A heap-based buffer overflow in file might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.37-r1 | >= 5.37-r1 |
file is a utility that guesses a file format by scanning binary data for patterns.
It was discovered that file incorrectly handled certain malformed files.
A remote attacker could entice a user to process a specially crafted file via libmagic or file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.37-r1"
A vulnerability in file could lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.33-r2 | >= 5.33-r2 |
file is a utility that guesses a file format by scanning binary data for patterns.
File does not properly utilize the do_core_note function in readelf.c in libmagic.a.
A remote attacker could send a specially crafted ELF file possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.33-r2"
A stack-based buffer overflow was found in file, possibly resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.32 | >= 5.32 |
file is a utility that guesses a file format by scanning binary data for patterns.
An issue discovered in file allows attackers to write 20 bytes to the stack buffer via a specially crafted .notes section.
A remote attacker, by using a specially crafted .notes section in an ELF binary, could execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.32"
Multiple vulnerabilities have been found in file, the worst of which could allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.23 | >= 5.23 |
file is a utility that guesses a file format by scanning binary data for patterns.
Multiple vulnerabilities have been discovered in file. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user or automated system to process a specially crafted input file, possibly resulting in execution of arbitrary code with the privileges of the process, a Denial of Service condition or have other unspecified impacts.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.23"
Vulnerabilities in file could allow a context-dependent attack to create a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.22 | >= 5.22 |
The file utility attempts to identify a file’s format by scanning binary data for patterns.
Multiple issues with the ELF parser used by the file utility have been detected and fixed.
A context-dependent attacker can cause Denial of Service.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.22"
A vulnerability in file could allow a context-dependent attack to create a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.21 | >= 5.21 |
The file utility attempts to identify a file’s format by scanning binary data for patterns.
An issue with the ELF parser used by the file utility can cause a resource consumption when reading a specially-crafted ELF binary.
A context-dependent attacker may be able to cause Denial of Service.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.21"
A vulnerability in file could result in Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.15 | >= 5.15 |
file is a utility that guesses a file format by scanning binary data for patterns.
BEGIN regular expression in the awk script detector in magic/Magdir/commands uses multiple wildcards with unlimited repetitions.
A context-dependent attacker could entice a user to open a specially crafted file, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.15"
A vulnerability in file could result in Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.17 | >= 5.17 |
file is a utility that guesses a file format by scanning binary data for patterns.
A flaw was found in the way the file utility determines the type of a file.
A remote attacker could entice a user to open a specially crafted file, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.17"
A vulnerability in file could result in Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 5.11 | >= 5.11 |
file is a utility that guesses a file format by scanning binary data for patterns.
Multiple out-of-bounds read errors and invalid pointer dereference errors have been found in cdf.c.
A remote attacker could entice a user to open a specially crafted Composite Document File (CDF) using file, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-5.11"
An integer overflow vulnerability has been reported in file allowing for the user-assisted execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | x86 ppc hppa | < 4.21 | >= 4.21 |
file is a utility that guesses a file format by scanning binary data for patterns.
Colin Percival from FreeBSD reported that the previous fix for the file_printf() buffer overflow introduced a new integer overflow.
A remote attacker could entice a user to run the file program on an overly large file (more than 1Gb) that would trigger an integer overflow on 32-bit systems, possibly leading to the execution of arbitrary code with the rights of the user running file.
There is no known workaround at this time.
Since file is a system package, all Gentoo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-4.21"
A vulnerability has been discovered in file allowing for a denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | = 4.21 | >= 4.21-r1 |
file is a utility that identifies a file format by scanning binary data for patterns.
Conor Edberg discovered an error in the way file processes a specific regular expression.
A remote attacker could entice a user to open a specially crafted file, using excessive CPU ressources and possibly leading to a Denial of Service. Note that this vulnerability could be also triggered through an automatic file scanner like amavisd-new.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-4.20-r1"
A buffer underflow vulnerability has been reported in file allowing for the user-assisted execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 4.20 | >= 4.20 |
file is a utility that guesses a file format by scanning binary data for patterns.
Jean-Sebastien Guay-Leroux reported an integer underflow in file_printf function.
A remote attacker could entice a user to run the "file" program on a specially crafted file that would trigger a heap-based buffer overflow possibly leading to the execution of arbitrary code with the rights of the user running "file". Note that this vulnerability could be also triggered through an automatic file scanner like amavisd-new.
There is no known workaround at this time.
Since file is a system package, all Gentoo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-4.20"
The code for parsing ELF headers in file contains a flaw which may allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/file | * | < 4.12 | >= 4.12 |
file is a utility used to identify the type of a file.
A possible stack overflow has been found in the ELF header parsing code of file.
An attacker may be able to create a specially crafted ELF file which, when processed with file, may allow the execution of arbitrary code.
There is no known workaround at this time.
All file users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/file-4.12"